A retention period keeps data for a defined time and then lets it be deleted. A legal hold keeps data until someone removes the hold, with no end date. They are independent: if both apply, data stays protected until both are gone. Neither overrides the GDPR duty not to keep personal data longer than necessary without a basis.
How storage systems model it
AWS S3 Object Lock is a clear example. A retention period protects an object version until a retain-until date. A legal hold gives the same protection with no expiry and stays until removed. AWS says legal holds are independent of retention periods: if the retention period ends while a hold remains, the object stays protected, and removing a hold during a retention period leaves the retention in force.
AWS suggests legal hold when you are not sure how long data must stay immutable, such as an upcoming external audit or an ongoing project. It also describes variable retention, where the end date is set when an event hold is released, for cases where retention begins at a business event like account closure.
What a legal hold is for
The typical reasons are a lawsuit, an investigation or an audit. The aim is to stop routine deletion of material that may be needed. The legal reasoning belongs to your counsel, and the details differ by country, so this post covers only how to run it operationally.
Operating rules
- One owner. Legal or compliance issues and lifts holds, in writing.
- A register. Record the matter, date, scope, system and owner.
- Suspend automated deletion for the scope. Check lifecycle rules, log rotation and backup expiry too.
- Review on a schedule. Holds that never end become silent over-retention.
- Lift in writing, then let normal retention resume.
The GDPR tension
Article 5(1)(e) says personal data should be kept in a form permitting identification for no longer than necessary for the purposes of processing, with exceptions such as archiving or research under safeguards. A hold tied to a real legal need is a purpose. Holding data just in case is not. Review with your data protection advisor. See how to build a retention schedule.
A short scenario
A customer disputes an invoice and counsel asks you to preserve related emails, tickets and logs. Routine rules would delete the support tickets after twelve months, and some are at month eleven. Without a hold they disappear next week. With a hold, the register records the matter, the systems in scope and the owner, deletion jobs skip the scope, and storage level holds protect the relevant objects. Two years later the dispute ends, counsel lifts the hold in writing, and normal retention resumes at once. Any ticket past its period is then deleted promptly. The register shows the whole story from start to finish.
Quick check
Does a legal hold need a retention period too?
No. They are separate. A hold has no end date by design.
Who can place a hold in S3?
Any user with the s3:PutObjectLegalHold permission, according to AWS, so limit that permission.
Sources
Last reviewed: 19 October 2026.
